CVE-2023-41061

Deeper analysis

A validation issue was addressed with improved logic in watchOS, iOS, and iPadOS. The flaw affects versions prior to watchOS 9.6.2, iOS 16.6.1, and iPadOS 16.6.1 and permits a maliciously crafted attachment to trigger arbitrary code execution. The issue carries a CVSS 3.1 base score of 7.8 with an attack vector that is local, requires low complexity and no privileges, but depends on user interaction with the attachment.

An attacker able to supply a crafted attachment can achieve code execution on the target device, resulting in full compromise of confidentiality, integrity, and availability. Because the vector is local and user-interaction dependent, exploitation typically involves delivering the attachment through messaging, email, or other channels that allow the victim to open or preview the file.

Apple security updates HT213905 and HT213907, along with the corresponding Full Disclosure postings, state that the vulnerability is resolved by installing watchOS 9.6.2, iOS 16.6.1, or iPadOS 16.6.1. The advisories further note that Apple is aware of reports indicating the issue may have been actively exploited in the wild. The associated EPSS values have remained low and essentially flat, with a current score of 0.0114 and a peak of 0.0115.